Distributed and adaptive computer network analytics

Patent metadata

Field	Value
Publication number	US-2016197799-A1
Application number	US-201514589953-A
Country	US
Kind code	A1
Filing date	Jan 5, 2015
Priority date	Jan 5, 2015
Publication date	Jul 7, 2016
Grant date	—

Abstract

A network analytics controller in a computer network receives specification of a network analysis task. The controller creates maplets. Each maplet corresponds to an agent executing on a network node in the computer network. Each maplet specifies the network data collection configuration, collected data processing, and processed data reporting to be performed to support the network analysis task at the node executing the corresponding agent. The controller communicates the maplet corresponding to the agent over the computer network to each agent. Each agent receiving a maplet configures its corresponding network node for network data collection, collected data processing, and processed data reporting in accordance with the received maplet. Each agent receiving a maplet collects and processes network data, and reports the processed data to the controller, in accordance with the configuration. The controller aggregates, as the result of the network analysis task, the data reported from each agent.

First claim

We claim:

1 . A method, comprising:
receiving, by a network analytics controller in a computer network, a specification of a network analysis task; creating, by the network analytics controller, a plurality of maplets, each maplet:
corresponding to a particular agent executing on a particular network node in the computer network, and
specifying network data collection configuration, collected data processing, and processed data reporting to be performed to support the specified network analysis task at the particular network node executing the corresponding agent;
communicating, by the network analytics controller over the computer network to each particular agent executing on a particular network node, the maplet corresponding to the particular agent; configuring, by each agent receiving a communicated maplet, the network node corresponding to the agent receiving the maplet for network data collection, collected data processing, and processed data reporting in accordance with the maplet received by the agent; collecting network data and processing the collected network data, by each agent receiving a maplet, in accordance with the configuration; reporting, to the network analytics controller, by each agent receiving a maplet, the processed data in accordance with the configuration; and aggregating, by the network analytics controller, the data reported from each agent receiving a maplet, as a result of the specified network analysis task.

2 . The method of claim 1 :
wherein at least one of the network data collection configuration, collected data processing, and processed data reporting specified by a first maplet is adaptive to the processed data reported in accordance with a second maplet, and wherein the method further comprises adapting at least one of the network data collection, collected data processing, and processed data reporting at the network node of the first maplet to the processed data reported in accordance with the second maplet.

3 . The method of claim 2 , wherein the first maplet and the second maplet are the same maplet.

4 . The method of claim 2 , wherein the first maplet and the second maplet are different maplets.

5 . The method of claim 1 , wherein configuring network data collection and collected data processing comprises configuring probes of the operating system of the corresponding network node to collect network data to support the specified network analysis task.

6 . Logic encoded on one or more tangible media for execution and when executed operable to:
receive a specification of a network analysis task in a computer network; create a plurality of maplets, each maplet:
corresponding to a particular agent executing on a particular network node in the computer network; and
specifying network data collection configuration, collected data processing, and processed data reporting to be performed to support the specified network analysis task at the particular network node executing the corresponding agent;
communicate, over the computer network to each particular agent executing on a particular network node, the maplet corresponding to the particular agent; configure, by each agent receiving a communicated maplet, the network node corresponding to the agent receiving the maplet for network data collection, collected data processing, and processed data reporting in accordance with the maplet received by the agent; collect network data and process the collected network data, by each agent receiving a maplet, in accordance with the configuration; report, to a network analytics controller, by each agent receiving a maplet, the processed data in accordance with the configuration; and aggregate, by the network analytics controller, the data reported from each agent receiving a maplet, as the result of the specified network analysis task.

7 . The logic of claim 6 :
wherein at least one of the network data collection configuration, collected data processing, and processed data reporting specified by a first maplet is adaptive to the processed data reported in accordance with a second maplet, and wherein the logic, when executed, is further operable to adapt at least one of the network data collection, collected data processing, and processed data reporting at the network node of the first maplet to and the processed data reported in accordance with the second maplet.

8 . The logic of claim 7 , wherein the first maplet and the second maplet are the same maplet.

9 . The logic of claim 8 , wherein the first maplet and the second maplet are different maplets.

10 . The logic of claim 6 , wherein configuring network data collection and collected data processing comprises configuring probes of the operating system of the corresponding network node to collect network data to support the specified network analysis task.

11 . A system, comprising:
a storage device; and a processor communicatively coupled to the storage device, wherein the processor executes application code instructions that are stored in the storage device to cause the system to:
receive a specification of a network analysis task in a computer network;
create a plurality of maplets, each maplet:
corresponding to a particular agent executing on a particular network node in the computer network; and
specifying network data collection configuration, collected data processing, and processed data reporting to be performed to support the specified network analysis task at the particular network node executing the corresponding agent;

communicate, over the computer network to each particular agent executing on a particular network node, the maplet corresponding to the particular agent;
configure, by each agent receiving a communicated maplet, the network node corresponding to the agent receiving the maplet for network data collection, collected data processing, and processed data reporting in accordance with the maplet received by the agent;
collect network data and process the collected network data, by each agent receiving a maplet, in accordance with the configuration;
report, to a network analytics controller, by each agent receiving a maplet, the processed data in accordance with the configuration; and
aggregate, by the network analytics controller, the data reported from each agent receiving a maplet, as the result of the specified network analysis task.

12 . The system of claim 11 :
wherein at least one of the network data collection configuration, collected data processing, and processed data reporting specified by a first maplet is adaptive to the processed data reported in accordance with a second maplet, and wherein the logic, when executed, is further operable to adapt at least one of the network data collection, collected data processing, and processed data reporting at the network node of the first maplet to and the processed data reported in accordance with the second maplet.

13 . The system of claim 12 , wherein the first maplet and the second maplet are the same maplet.

14 . The system of claim 13 , wherein the first maplet and the second maplet are different maplets.

15 . The system of claim 11 , wherein configuring network data collection and collected data processing comprises configuring probes of the operating system of the corresponding network node to collect network data to support the specified network analysis task.

16 . The system of claim 11 wherein:
the application code instructions that cause the system to receive a specification of a network analysis task, create a plurality of maplets to support the specified task

Assignees

• Cisco Tech Inc

Inventors

• Clemm Ludwig Alexander
• Chandramouli Yegnanarayanan
• Krishnamurthy Saileshwar

Classifications

• H04L41/0803

  Configuration setting · CPC title

• H04L41/046 Primary

  comprising network management agents or mobile agents therefor · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L43/12

  Network monitoring probes · CPC title

• H04L43/06 Primary

  Generation of reports · CPC title